Privacy policy

Last updated: November 6, 2026

1. Who we are

Forecraft (“Forecraft,” “we,” “us,” or “our”) operates the financial close workflow platform available at forecraft.tech.

Forecraft is a financial close workflow platform. For GDPR purposes, see the contact address below. Legal entity details will be updated upon formal incorporation.

For GDPR purposes, Forecraft acts as a data processor with respect to the financial data you upload on behalf of your clients, and as a data controller with respect to your account data and usage data.

2. What data we collect

Data you provide directly

Account data

Name, email address, and password (stored as a bcrypt hash, never in plain text).

Workspace and firm settings

Firm name, client workspace names, brand colors, logo, accounting method preferences, and other configuration you set up within the Service.

Financial data

Profit & loss files, balance sheets, budget files, and any other financial documents you upload or that Forecraft pulls from accounting integrations on your request. This is your clients’ financial data. You retain ownership of it.

Payment data

Payment processing is handled entirely by Stripe. We store only your Stripe Customer ID and Subscription ID. We never store your card number, bank account details, or any payment credentials.

Communications

Emails you send to our support or privacy addresses, feedback submitted through the Service, and any other communications with us.

Data collected automatically

Usage data

Pages visited, features used, actions taken within the Service, and timestamps. Usage logs do not contain the content of your financial data, only interaction events (e.g., “report generated,” “file uploaded”).

Stored documents

The file of a document added through Add documents is deleted 12 months after it was added, or after the period the workspace owner chooses in Settings (6, 12, 24 or 36 months). The figures confirmed from it stay with the workspace. Deleting the document, its workspace or your account deletes the file sooner.

Authentication and security logs

Login times, IP addresses, and device information. Retained for 90 days for security and fraud prevention purposes.

Technical data

Browser type, operating system, and device type, used to ensure compatibility and investigate errors.

Data from integrations

QuickBooks Online / Xero

If you connect an accounting integration, Forecraft retrieves financial reports (P&L, balance sheets) from that integration on your explicit request. OAuth tokens that authorize this access are encrypted at rest. You may disconnect an integration at any time from Settings.

Gusto

If you connect Gusto, Forecraft retrieves payroll totals by month (gross pay, employer taxes, benefits and the number of payrolls) on your explicit request, to check them against the payroll lines in your books. It does not retrieve any employee’s own pay. It also keeps the company name and the email of the Gusto account that connected it. OAuth tokens are encrypted at rest. You may disconnect at any time from Settings.

3. How we use your data

Account data

To create and manage your account, authenticate you, and communicate with you about your subscription and the Service.

Financial data

To generate close packs, variance analysis, and management reports: the core purpose of the Service. Financial data is processed only to provide these features to you.

AI processing

When you use AI-powered features (executive narrative, variance explanations), relevant financial data is sent to Anthropic’s API to generate the requested text. This data is processed for that request only, and Anthropic deletes API inputs and outputs within 30 days (longer only if a request is flagged for a usage-policy violation or the law requires it). Before anything is sent we replace the workspace name with a neutral placeholder and remove the names of task owners, so the request carries figures and line-item names but not who they belong to. A document added through Add documents is sent to Anthropic as the file you added, to be read into figures, so it carries whatever the document carries, names included. Nothing is calculated from a figure read this way until a person in the workspace confirms it. AI-drafted text is a draft: it is not shared with anyone until you review it and choose to send it, and you should check it as you would any draft. AI is never used to make decisions about you or your clients. Anthropic’s API terms prohibit using API inputs to train or improve their models without customer consent, and we have not granted that consent. See Anthropic’s Privacy Policy for their practices.

Authentication logs

To detect and prevent unauthorized access to your account. Retained for 90 days.

Usage data

To understand how the Service is used and to improve features and performance. This data is aggregated and not linked to specific financial data.

Payment data

Processed by Stripe to manage subscriptions and billing. We receive confirmation of payment status only.

Communications

To respond to your support requests and to send transactional communications (account verification, password reset, billing notifications).

4. How we do not use your data

We want to be explicit about what we do not do:

• We do not sell your personal data or your clients’ financial data.
• We do not use financial data to train any AI model, Forecraft’s or anyone else’s.
• We do not share your data with advertisers or ad networks.
• We do not build profiles of you or your clients for advertising or marketing purposes.
• We do not use your clients’ financial data for any purpose other than providing the Service to you.

5. Data sharing and sub-processors

We share data only with the service providers necessary to operate the Service (“sub-processors”). All sub-processors are contractually bound to process data only on our instructions and to maintain appropriate security.

Vercel: Hosting and infrastructure

Our application runs on Vercel’s platform (United States). Financial data passes through Vercel’s servers to reach our database. Files added through Add documents are stored in Vercel’s private file storage (United States), encrypted at rest, and read back only by our servers.

Neon: Database

Your financial data, account data, and workspace data are stored in Neon’s PostgreSQL database (United States). Database connections are encrypted.

Anthropic: AI narrative generation and document reading

Financial data is sent to Anthropic’s API only when you use AI features, and only for that request. The request carries the figures and line-item names the feature needs, with the workspace name and task owners removed. A document added through Add documents is sent as the file you added.

Stripe: Payment processing

Billing data is processed by Stripe. We do not receive or store raw payment credentials. Subject to Stripe’s Privacy Policy.

Upstash: Rate limiting and abuse protection

Used for rate limiting and to block abusive traffic. Stores IP addresses and email addresses briefly (from minutes up to 30 days) to count failed sign-ins and blocked requests. Does not store financial data.

Resend: Transactional email

Sends account email (verification, password resets, security notices, billing notices, reminders) and the emails you send through Forecraft: invitations, comment notifications, and client reports. A client report email contains the summary figures you chose to send and goes to the recipient you entered. Resend receives the recipient address and the message content in order to deliver it.

Sentry: Error monitoring

Application errors and performance traces are reported to Sentry (United States) for debugging. Before a report leaves, email addresses are cut down to their domain and the secret part of share, portal, invitation and unsubscribe links is removed. Reports may still contain technical details such as page addresses and error messages. If you accept analytics cookies, Sentry may also record a small sample of sessions (and sessions where an error occurs) as a replay, with all on-screen text and inputs masked.

PostHog: Product analytics

Only if you accept analytics cookies, PostHog (United States) records which pages and features are used so we can improve the product. It never receives uploaded financial data. You can change your choice at any time from the cookie settings link in the footer, and it takes effect straight away. Separately, our servers tell PostHog when a signed-in account completes a few business actions (signing up, starting a trial, connecting an accounting system, generating or sharing a first pack, changing plan). These records carry an internal account id, never a name, an email address or a figure, and we use them to measure how the product is used under legitimate interests (see section 7).

Accounting integrations you connect

If you connect Intuit QuickBooks Online or Xero, Forecraft reads the reports you ask for (such as profit and loss and balance sheet) from that account, with the access you approve on Intuit’s or Xero’s own sign-in screen. Access tokens are encrypted at rest (AES-256-GCM). You can disconnect at any time from Forecraft or from your Intuit or Xero account, which revokes our access. Intuit and Xero are the controllers of the data they hold; their own privacy policies apply to it.

If you connect Gusto, Forecraft reads payroll totals by month, with the access you approve on Gusto’s own sign-in screen, and never an individual employee’s pay. Access tokens are encrypted at rest the same way. You can disconnect at any time from Forecraft or from your Gusto account. Gusto is the controller of the data it holds; its own privacy policy applies to it.

Sub-processor details

Legal disclosures

We may disclose your data if required to do so by law, court order, or government authority. Where permitted, we will notify you before complying with such a request.

Business transfers

If Forecraft is involved in a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

6. Data retention

Account and financial data

Kept for as long as your account exists. If you cancel a paid subscription, your account moves to the free plan and keeps its data, so nothing is deleted because you stopped paying. Data is deleted when you delete it, when you delete your account, or when you ask us to (see section 7).

Authentication and security logs

Retained for 90 days, then automatically purged.

Pack sign-offs, sends and decisions

Who prepared and who signed each month’s pack, when it was saved, sent or published and to which email domain, changes to its decisions, owners and due dates, and your client’s acknowledgments are kept with the workspace for as long as your account exists. They are the record you need if a client later asks what was sent or agreed.

Deleted data

A deleted workspace is removed from the product at once and kept for 7 days, so an accidental deletion can be undone if you email us, then deleted. Deleting your account deletes the workspaces you alone own at once. Documents stored for a workspace are deleted with it. Our database provider keeps a short restore history so that we can recover from an outage; deleted data leaves that history when its window passes, and always within 30 days.

Expired share links and invitations

Deleted 7 days after they expire.

Stripe payment records

Retained per Stripe’s own data retention policies.

7. Your rights and our lawful basis

You are the data subject for your account data. These rights apply to everyone who uses Forecraft, wherever you are. Where a right has a name in the GDPR or UK GDPR it is given in brackets, because that is the name a regulator or a reviewer will look for.

All users

• Access (right of access, Article 15): Obtain a copy of the personal data we hold about you. Use “Download my data” in Settings, under You, or email privacy@forecraft.tech.
• Correction (right to rectification, Article 16): Correct inaccurate or incomplete data. Your name is editable in Settings, under You; for anything else, email us.
• Deletion (right to erasure, Article 17): Delete your account. Your personal data is deleted at once, along with every workspace you are the only member of. A workspace you share with other people belongs to them as well, so it stays with them and you are removed from it. Use “Delete account” in Settings, under You, or email privacy@forecraft.tech.
• Export and portability (right to data portability, Article 20): Download your personal data, your workspace memberships and the packs, tasks, share links and invitations you created as one machine-readable JSON file, at any time, from Settings, under You. The file never contains credentials.

GDPR and UK GDPR: EEA and UK users

If you are located in the European Economic Area or the United Kingdom, the GDPR or the UK GDPR (as retained by the Data Protection Act 2018) also gives you:

• The right to restriction of processing (Article 18).
• The right to object to processing based on legitimate interests (Article 21).
• The right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects (Article 22). Forecraft makes no such decisions.
• The right to lodge a complaint with your supervisory authority (Article 77): in the EEA, the data protection authority of the country where you live or work; in the UK, the Information Commissioner’s Office.

Lawful basis for processing (Article 6)

Each purpose we process personal data for rests on one lawful basis. Where we act as processor for your clients’ financial data, the lawful basis is yours as controller and is recorded in the Data Processing Addendum.

Performance of a contract (Article 6(1)(b))

Creating and running your account, your workspaces and your subscription; sending transactional email about them; generating the close packs and reports you ask for. Data: account data, workspace settings, Stripe customer and subscription identifiers.

Legitimate interests (Article 6(1)(f))

Keeping the Service secure and available: sign-in and security logs, rate limiting, abuse prevention, error monitoring with email addresses and link secrets removed, and the server-side usage records described under PostHog in section 5, which carry no names, email addresses or figures. Data: authentication logs, IP addresses, device and browser type, interaction events. You may object; see above.

Consent (Article 6(1)(a))

Non-essential analytics and session replay, only if you opt in through the cookie banner. You can withdraw at any time from the cookie settings link in the footer and withdrawing is as easy as giving it.

Legal obligation (Article 6(1)(c))

Keeping billing records for as long as tax and accounting law requires, and responding to lawful requests from authorities.

CCPA: California users

• Right to know what personal information we collect.
• Right to delete your personal information.
• Right to opt out of sale: we do not sell personal information.
• Right to non-discrimination for exercising CCPA rights.

To exercise any rights, contact privacy@forecraft.tech. We respond within one month to GDPR and UK GDPR requests (extendable by two further months for complex requests, in which case we tell you within the first month) and within 45 days to CCPA requests. We may ask you to confirm you control the account email before acting on a request, so that nobody else can obtain or delete your data by asking.

8. Cookies and tracking

Session cookies

Required for authentication. You are signed out after 24 hours without activity.

Preference cookies

Store UI settings such as workspace selection.

We do not use advertising cookies, third-party tracking cookies, or behavioral profiling.

A cookie consent banner is shown on first visit. You may accept essential cookies only, or opt in to analytics. Your preference is stored for 12 months.

9. Data security

• Encryption in transit: TLS 1.2 or higher on every connection.
• Encryption at rest: AES-256.
• Passwords hashed with bcrypt (cost factor 12), never stored in plain text.
• OAuth tokens for integrations encrypted at rest.
• Workspace isolation: users in one workspace cannot access another.
• Two-factor authentication (TOTP) available for all accounts.
• Rate limiting on authentication endpoints.
• Regular security reviews.

Breach notification: We will notify you of a breach affecting your data without undue delay and within 72 hours where required by GDPR. See our Security page for full detail.

10. International data transfers

Forecraft’s infrastructure is located in the United States. If you access the Service from the EEA, UK, or another jurisdiction with data transfer restrictions, your data will be transferred to and processed in the United States.

International transfers from the EEA and UK are made under Standard Contractual Clauses (SCCs) as adopted by the European Commission (2021/914). A copy of the applicable SCCs is incorporated into our Data Processing Addendum. For UK users, transfers comply with the UK International Data Transfer Agreement (IDTA).

11. Children

Forecraft is not directed to individuals under 18. We do not knowingly collect data from minors. Contact privacy@forecraft.tech if you believe we have collected data from a minor.

12. Contact for privacy

privacy@forecraft.tech

13. Changes to this policy

We will notify you of material changes by email at least 30 days before they take effect. Continued use after the effective date constitutes acceptance.

Last updated: November 6, 2026

See also: Terms of Service, Acceptable Use Policy, Data Processing Addendum, Security, Plain-English Data Guide